Files
neovim/src/nvim
zeertzjq 40fb2818b6 vim-patch:9.1.2085: Use-after-free in winframe_remove()
Problem:  Use-after-free in winframe_remove() (henices)
Solution: Set window_layout_locked() inside winframe_remove()
          and check that writing diff files is disallowed when the
          window layout is locked.

It can happen with a custom diff expression when removing a window:

 1. Buffer was removed, so win_frame_remove() is called to remove the
    window.
 2. win_frame_remove() → frame_new_height() → scroll_to_fraction()
    → diff_check_fill() (checks for filler lines)
 3. diff_check_fill() ends up causing a diff_try_update, and because we
    are not using internal diff, it has to first write the file to a
    buffer using buf_write()
 4. buf_write() is called for a buffer that is not contained within a
    window, so it first calls aucmd_prepbuf() to create a new temporary
    window before writing the buffer and then later calls
    aucmd_restbuf(), which restores the previous window layout, calling
    winframe_remove() again, which will free the window/frame structure,
    eventually freeing stuff that will still be accessed at step 2.

closes: vim/vim#19064

ead1dda74a

Nvim doesn't have this bug as Nvim uses a floating window as autocommand
window, and removing it doesn't need winframe_remove().

Co-authored-by: Christian Brabandt <cb@256bit.org>
2026-01-14 13:56:01 +08:00
..
2026-01-13 09:41:51 +01:00
2026-01-07 08:11:42 +08:00
2025-11-19 20:43:15 -08:00
2026-01-12 03:50:57 +00:00
2025-12-20 22:07:27 -05:00
2025-12-20 22:07:27 -05:00
2025-12-15 13:55:15 -05:00
2026-01-12 03:50:57 +00:00
2025-11-16 20:36:07 -08:00
2025-09-13 22:49:50 -04:00
2025-12-06 20:33:02 -05:00
2026-01-02 00:27:35 -05:00
2025-11-19 20:43:15 -08:00
2025-12-16 12:55:32 +08:00